A bank approves an AI centre of excellence and then writes one job advert. Head of AI, reporting to the chief data officer, owning platform, governance, skills and delivery. A capable person takes it. A year later the same bank has infrastructure nobody independently validated, a model inventory nobody keeps current, and an AI Act file that somebody assembled in the evenings between other work. Nothing went wrong in the hire. The gap was in the org chart, and the org chart was one box.
The design I want to walk through does the opposite, and it does it on a single slide. It comes from a board-level deliverable I worked on for a consumer and SME banking group operating across several European markets, and it draws the centre as six boxes rather than one: a Head of AI and Data at the top, and five functional leads beneath, each with its remit written out in words rather than left to the title.
Say what the document is before reading anything into it. It is a design. No centre existed when this was written, nobody had been appointed, and none of the roles below describes a person at a desk. The slide is useful because the set of five is complete, and completeness is a property you can test against your own organisation in an afternoon.
The reporting line is a design decision, and it is made first
Before any of the five roles appear, the slide fixes two things about the person above them. The Head of AI and Data reports to the chief data officer or the chief operating officer. And that head owns strategy, budget and talent.
Those three are worth reading slowly, because they are what separate a centre from a working group. Strategy without budget produces papers. Budget without talent produces contractors. Talent without strategy produces a team that is very good at whatever arrived last. Most AI functions I meet hold one of the three, occasionally two, and the missing one is usually budget, which is why they spend their first year negotiating for capacity inside somebody else's plan.
The alternative parent matters too. A centre reporting into data is judged on assets; one reporting into operations is judged on process outcomes. The design leaves the line open, and the two parents will ask for different evidence in year one.
Five remits, and the test is whether anything falls between them
The MLOps Lead owns the platform, continuous integration and deployment, model monitoring, and the vendor technology underneath. The Model Risk Lead owns validation, risk tiering, and the interface to model risk management. The Data Platform Lead owns pipelines, the feature store, and data quality. The Responsible AI Lead owns the EU AI Act, ethics, fairness and policy. The AI programme office and delivery lead owns agile squads, intake, and value tracking.
- 5
- Leadership remits named under the Head of AI and Data
- 3
- Mandate pillars for the centre, none of them use case delivery
- 2
- Governance bodies drawn above the centre
- 0
- Roles filled at the point this design was written
Run the gap test on that list rather than admiring it. A model is built somewhere, trained on data from somewhere, deployed through something, checked by somebody, classified against a regulation by somebody else, and paid for out of a portfolio someone tracks. Every one of those verbs has an owner in the five. That is the whole claim, and it is a modest one.
The failure mode this guards against is not overload. It is silence. When a remit has no name against it, nothing announces the absence. The platform lead assumes risk is validating; the risk function assumes the platform lead is monitoring; the AI Act obligation belongs to whoever last read about it. A named remit produces a person who has to say no or has to say yes, and either answer is more useful than an assumption.
The two remits most banks fold into somebody else's job
Two of the five are the ones that go missing first, and the design is deliberate about both.
The Responsible AI Lead is a full role, not a duty attached to a compliance officer's existing week. Its scope is the EU AI Act, ethics, fairness and policy. In a lender this is not abstract work. Credit scoring is high risk under the Act, and the obligations that attach to a high risk system are standing commitments rather than a project with an end date. A bank that treats it as a shared duty is not treating it as a duty at all; it is treating it as an inbox.
The Model Risk Lead is the more interesting one, because of where the design puts it. Validation and risk tiering sit inside the centre, with an explicit interface out to the bank's model risk management function rather than a merger into it. That placement buys speed. A validation capability that understands machine learning and sits next to the people building it will clear work faster than one queued behind the credit models.
It also raises a question the slide does not answer, and I would rather name it than let a reader assume the design solved it. Validation inside the same function that builds is not independent in the sense a model risk policy usually means by that word. The interface to model risk management is presumably what carries the independence, and the design says the interface exists without saying what crosses it. If you take this chart into your own bank, that arrow is the first thing to write a paragraph about. Who signs off, on what evidence, and who can overrule the centre when the answer is inconvenient.
The mandate excludes the thing everyone will ask the centre to do
The same slide gives the centre three mandate pillars, and the omission is the point.
Standards and methods asks the centre to define the bank's own named way of delivering AI, with coding standards and a delivery playbook attached to that name. Platform and tooling gives it central machine learning infrastructure, the vendor contracts, and the reusable assets. Enablement and skills gives it an upskilling academy, communities of practice and general literacy across the bank.
Use case delivery appears nowhere in the three. The centre sets how work is done, supplies what it is done on, and teaches people to do it. The building happens in the business. That division is what makes the portfolio design in the same programme coherent, where twelve use cases sit three to a business area under a hub that owns platform and standards. The centre described here is that hub, drawn from the inside.
There is a tension in the chart worth reading rather than smoothing over. One of the five leads is called delivery while the mandate excludes use case delivery. The written scope resolves it: agile squads, intake, and value tracking. That is delivery discipline rather than delivery ownership. Intake decides what is allowed to start, squad practice decides how it runs, value tracking decides whether it continues. None of those is the same as owning whether the churn model works, which stays with the business area that wanted it. The distinction survives only if somebody defends it out loud in year one, because every business unit under pressure will try to hand the centre a deadline.
What to do with the chart on a Monday
Print the five remits. Put one human name against each. Read the blanks.
That exercise is cheap and it is not really about hiring. Most mid-size banks will not fund five leaders in the first year, and this design does not claim otherwise; it names remits, not headcount. Doubling up is a legitimate answer. A Data Platform Lead who also carries MLOps is a workload problem you can see and manage. A Responsible AI remit that nobody holds is a compliance problem you cannot see at all. The chart converts the second kind into the first, which is the only real service an org chart performs.
Two boxes sit above the centre in the same picture. A board AI oversight committee approves strategy and risk; an executive steering group prioritises the portfolio. Between them they answer the question a new head of AI is asked in month three, which is who decides when the business wants something the standards do not permit.
Source: one slide from a board-level AI transformation deliverable I worked on for a consumer and SME banking group operating across several European markets. It is a design document, not a record of a built organisation. The five remits, the reporting line, the three mandate pillars and the two governance bodies are all as written in the source. The independence question about validation sitting inside the centre, and the reading of the delivery remit as discipline rather than ownership, are ours.
“One box on an org chart is not a centre of excellence. It is a single point of failure with a good salary band and four remits nobody has been told they own.”
Get in touch
Put RealAI’s applied-AI team on your hardest data problem.
We help enterprises move from pilots to production: sovereign models, governed data, and agents you can audit. Start with a value-first assessment.